OFFICE OF MANAGEMENT AND BUDGET

CIRCULAR NO. A-108 

TO THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES

SUBJECT: Federal Agency Responsibilities for Review, Reporting, and Publication 

under the Privacy Act 

1. Purpose 

2. Authorities

3. Applicability

4. Background 

5. Definitions

6. Publishing System of Records Notices 

7. Reporting Systems of Records to OMB and Congress 

8. Publishing Matching Notices

9. Reporting Matching Programs to OMB and Congress 

10. Privacy Act Implementation Rules

11. Privacy Act Exemption Rules

12. Privacy Act Reviews

13. Annual FISMA Privacy Review and Report 

14. Annual Matching Activity Review and Report 

15. Agency Website Posting 

16. Government-wide Responsibilities

17. Effectiveness 

18. Inquiries 

Appendix I – Summary of Key Requirements 

Appendix II – Office of the Federal Register SORN Template – Full Notice

Appendix III – Office of the Federal Register SORN Template – Notice of Revision 

Appendix IV – Office of the Federal Register Notice of Rescindment Template

Appendix V – Office of the Federal Register Matching Notice Template – Full Notice

Appendix VI – Office of the Federal Register Matching Notice Template – Notice of Revision 
2

1. Purpose 

This Office of Management and Budget (OMB) Circular describes agency responsibilities for 

implementing the review, reporting, and publication requirements of the Privacy Act of 1974 

(“the Privacy Act”),1 and related OMB policies. This Circular supplements and clarifies existing

OMB guidance, including OMB Circular No. A-130, Managing Information as a Strategic 

Resource,

2 Privacy Act Implementation: Guidelines and Responsibilities,3 Implementation of the 

Privacy Act of 1974: Supplementary Guidance,

4 and Final Guidance Interpreting the Provisions 

of Public Law 100-503, the Computer Matching and Privacy Protection Act of 1988.

5

 All OMB 

guidance is available on the OMB website.6

This Circular establishes general requirements. Agencies shall coordinate with OMB when 

implementing these general requirements and shall consult other OMB guidance documents and 

OMB’s Office of Information and Regulatory Affairs (OIRA) for the most up-to-date 

information. 

2. Authorities

OMB issues this Circular pursuant to the following authorities: 

a. Privacy Act of 1974;7

b. Paperwork Reduction Act of 1995;8 and

c. Federal Information Security Modernization Act of 2014.9

3. Applicability

This Circular applies to all agencies and records subject to the Privacy Act.

10 

 1 5 U.S.C. § 552a.

2 OMB Circular No. A-130, Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. The reissuance of 

Circular A-108 replaces the reporting and publication requirements in Appendix I of the 2000 version of Circular A130. See id. at n.115. 3 Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948 (July 9, 1975), available at

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 4 Implementation of the Privacy Act of 1974: Supplementary Guidance, 40 Fed. Reg. 56,741 (Dec. 4, 1975), available 

at https://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation1974.pdf. 5 Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer Matching and Privacy Protection 

Act of 1988, 54 Fed. Reg. 25,818 (June 19, 1989), available at

https://www.whitehouse.gov/sites/default/files/omb/inforeg/final_guidance_pl100-503.pdf. 6 OMB’s privacy guidance is available at https://www.whitehouse.gov/omb/inforeg_infopoltech. 7 5 U.S.C. § 552a. 8 44 U.S.C. §§ 3501-3521. 9 Id. §§ 3551-3558. 10 See 5 U.S.C. § 552a(a)(1), (4).
3

4. Background

The Privacy Act of 1974, which has been in effect since September 27, 1975, sets forth a series 

of requirements governing Federal agency practices with respect to certain information about 

individuals. Although the Privacy Act places principal responsibility for compliance on 

agencies, the statute requires the Director of OMB to develop guidelines and provide continuing 

assistance to and oversight of implementation by agencies.

11 

On July 1, 1975, OMB issued OMB Circular No. A-108, Responsibilities for the Maintenance of 

Records About Individuals by Federal Agencies, along with Privacy Act Implementation: 

Guidelines and Responsibilities (“Privacy Act Guidelines”).12 Circular A-108 provided guidance 

on agencies’ responsibilities under the Privacy Act, while the Privacy Act Guidelines provided 

more detailed implementation guidance for the statute. On September 30, 1975, OMB issued a 

supplement to Circular A-108 providing expanded guidance on the reporting requirements of the 

Privacy Act.13 This additional guidance on reporting requirements, which was subsequently 

updated,14 superseded the preliminary guidance on reporting requirements contained in the 

Privacy Act Guidelines.

On December 12, 1985, OMB issued OMB Circular No. A-130, Management of Federal 

Information Resources.

15 Circular A-130 established policies for the management of Federal 

information resources, including procedural and analytic guidelines for implementing specific 

aspects of the policies. Circular A-130 rescinded Circular A-108 and replaced it with an 

Appendix I, Federal Agency Responsibilities for Maintaining Records About Individuals. 

Appendix I to Circular A-130 reissued the pertinent guidance in the rescinded Circular A-108 

and provided further explanation of the requirements in the Privacy Act. OMB has revised 

Circular A-130 several times since its inception, including by incorporation of the requirements 

of the Computer Matching and Privacy Protection Act of 1988.16 

With the reissuance of Circular A-108, OMB is revising and relocating the guidance that since 

1985 had been included in Appendix I to Circular A-130. The reissued Circular A-108, Federal 

Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, replaces 

the November 28, 2000 version of Appendix I to Circular A-130 and supplements OMB’s 

Privacy Act Guidelines, which remain in effect. OMB has also revised and reissued Circular A-

 11 See id. § 552a(v). 12 Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948 (July 9, 1975), available at

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 13 OMB Circular No. A-108, Transmittal Memorandum No. 1, Responsibilities for the maintenance of records about 

individuals by Federal agencies (Sept. 30, 1975). 14 See, e.g., OMB Circular No. A-108, Transmittal Memorandum No. 3, Privacy Act implementation and revised 

guidance on new systems report (May 17, 1976). 15 OMB Circular A-130, Management of Federal Information Resources, 50 Fed. Reg. 52,730 (Dec. 24, 1985). 16 See OMB Circular A-130, Management of Federal Information Resources, 58 Fed. Reg. 36,068 (July 2, 1993).
4

130, Managing Information as a Strategic Resource, which provides guidance on the 

management of agencies’ privacy programs.17

5. Definitions

For the purpose of this Circular: 

a. The terms “agency,” “individual,” “maintain,” “matching program,” “non-Federal agency,” 

“recipient agency,” “record,” “routine use,” “source agency,” and “system of records,” are 

defined in the Privacy Act.18

b. Data Integrity Board. The term “Data Integrity Board” means the board of senior officials

designated by the head of an agency that is responsible for, among other things, reviewing 

the agency’s proposals to conduct or participate in a matching program and conducting an 

annual review of all matching programs in which the agency has participated.19 At a 

minimum, the Data Integrity Board includes the Inspector General of the agency, if any, and 

the senior official designated by the head of the agency as responsible for implementation of 

the Privacy Act20 (i.e., the Senior Agency Official for Privacy). 

c. Matching agreement. The term “matching agreement” means a written agreement between 

a recipient agency and a source agency (or a non-Federal agency) that is required by the 

Privacy Act for parties engaging in a matching program.21

d. Matching notice. The term “matching notice” means the notice published by an agency in 

the Federal Register upon the establishment, re-establishment, or modification of a matching 

program that describes the existence and character of the matching program.

22 A matching 

notice identifies the agencies involved, the purpose(s) of the matching program, the authority 

for conducting the matching program, the records and individuals involved, and additional 

details about the matching program. 

e. Senior Agency Official for Privacy. The term “Senior Agency Official for Privacy” means 

the senior official, designated by the head of each agency, who has agency-wide 

responsibility for privacy, including implementation of privacy protections; compliance with 

Federal laws, regulations, and policies relating to privacy; management of privacy risks at the 

agency; and a central policy-making role in the agency’s development and evaluation of 

legislative, regulatory, and other policy proposals.

 17 OMB Circular No. A-130, Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. 18 See 5 U.S.C. § 552a(a)(1)-(5), (7)-(11).

19 See id. § 552a(u). 20 See id. § 552a(u)(2). 21 See id. § 552a(o). 22 See id. § 552a(e)(12).
5

f. System of records notice. The term “system of records notice” (SORN) means the notice(s)

published by an agency in the Federal Register upon the establishment and/or modification

of a system of records describing the existence and character of the system.23 A SORN 

identifies the system of records, the purpose(s) of the system, the authority for maintenance 

of the records, the categories of records maintained in the system, the categories of 

individuals about whom records are maintained, the routine uses to which the records are

subject, and additional details about the system as described in this Circular. As explained in 

this Circular, a SORN may be comprised of a single Federal Register notice addressing all of 

the required elements that describe the current system of records, or it may be comprised of 

multiple Federal Register notices that together address all of the required elements.

6. Publishing System of Records Notices

 

a. General. The Privacy Act requires agencies to publish a SORN in the Federal Register

describing the existence and character of a new or modified system of records.

24 A SORN is 

comprised of the Federal Register notice(s) that identifies the system of records, the 

purpose(s) of the system, the authority for maintenance of the records, the categories of

records maintained in the system, the categories of individuals about whom records are 

maintained, the routine uses to which the records are subject, and additional details about the 

system. The requirement for agencies to publish a SORN allows the Federal Government to 

accomplish one of the basic objectives of the Privacy Act – fostering agency accountability 

through public notice. 

b. When to Publish a System of Records Notice. Agencies are required to publish a SORN in 

the Federal Register when establishing a new system of records and must also publish notice 

in the Federal Register when making significant changes to an existing system of records. 

As a general matter, significant changes are those that are substantive in nature and therefore 

warrant a revision of the SORN in order to provide notice to the public of the character of the 

modified system of records. The following are examples of significant changes:

(1) A substantial increase in the number, type, or category of individuals about whom 

records are maintained in the system. For example, a system covering physicians that 

is being expanded to include other types of health care providers (e.g., nurses or 

technicians) would require a revised SORN. Increases attributable to normal growth 

in a single category of individuals generally would not require a revised SORN. 

(2) A change that expands the types or categories of records maintained in the system. 

For example, a benefit system that originally included only earned income 

information that is being expanded to include unearned income information would 

require a revised SORN. 

(3) A change that modifies the scope of the system. For example, the combining of two 

or more existing systems of records. 

 23 See id. § 552a(e)(4). 24 See id.
6

(4) A change that modifies the purpose(s) for which the information in the system of 

records is maintained. 

(5) A change in the agency’s authority to maintain the system of records or maintain, 

collect, use, or disseminate the records in the system. 

(6) A change that modifies the way in which the system operates or its location(s) in such 

a manner as to modify the process by which individuals can exercise their rights 

under the statute (e.g., to seek access to or amendment of a record). 

(7) A change to equipment configuration (either hardware or software), storage protocol, 

type of media, or agency procedures that expands the availability of, and thereby 

creates substantially greater access to, the information in the system. For example, a 

change in the access controls that substantially increases the accessibility of the 

information within the agency. 

(8) A new routine use or significant change to an existing routine use that has the effect 

of expanding the availability of the information in the system.25 

(9) The promulgation of a rule to exempt a system of records from certain provisions of 

the Privacy Act.26 

This is not an exhaustive list of significant changes that would require a revised SORN. 

Other changes to a system of records would require a revised SORN if the changes are 

substantive in nature and therefore warrant additional notice. If an agency has questions 

about whether particular changes to a system of records are significant, the agency shall 

contact OIRA for assistance.

c. What to Publish in a System of Records Notice. Each notice of a new or modified system of 

records shall be drafted using the Office of the Federal Register SORN templates, which are 

provided in the appendices to this Circular. When an agency establishes a new system of 

records, the SORN is comprised of a single Federal Register notice that includes all of the 

required elements that are identified in Appendix II to this Circular, Office of the Federal 

Register SORN Template – Full Notice. When an agency modifies an existing system of 

records, the agency may choose to publish a Federal Register notice that includes all of the 

required elements identified in Appendix II, or a notice that includes the elements that are 

identified in Appendix III to this Circular, Office of the Federal Register SORN Template – 

Notice of Revision, as well as any other elements that are being revised. 

 25 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,963 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 26 A Privacy Act exemption rule that is part of a report of a new or significantly modified system of records may also 

be reviewed by OMB under applicable regulatory review procedures (see section 11 of this Circular for information 

about Privacy Act exemption rules).
7

d. Who Publishes a System of Records Notice. The agency responsible for maintaining a 

system of records (including by providing for the operation of a system of records by a 

contractor on behalf of the agency) publishes the SORN.27 Publication shall occur at the 

agency level, rather than the sub-agency, component, or program level. If a system of 

records will be maintained by a sub-agency or component of an agency, the broader agency 

shall publish the SORN and specify the sub-agency or component of the agency that will 

maintain the system of records. For example, the Department of the Treasury publishes 

SORNs covering systems of records maintained by the Internal Revenue Service.

e. Timing of a System of Records Notice.

28 A new or revised SORN is effective upon 

publication in the Federal Register, with the exception of any new29 or significantly modified

routine uses. As soon as a SORN is published in the Federal Register the agency may begin 

to operate the system of records – the agency may collect, maintain, and use records in the 

system, and the agency may disclose records pursuant to any of the conditions of disclosure 

in subsection (b) of the Privacy Act other than a new or significantly modified routine use. 

Any new or significantly modified routine uses require a minimum of 30 days after 

publication in the Federal Register before the routine uses are effective and may be used as 

the basis for disclosure of a record in the system.30 

Agencies shall publish notice of any new or significantly modified routine use sufficiently in 

advance of the proposed effective date of the routine use to permit time for the public to 

comment and for the agency to review those comments. In no circumstance may an agency 

use a new or significantly modified routine use as the basis for a disclosure fewer than 30 

days following Federal Register publication.31 

If an agency receives public comments on a published SORN, the agency shall review the 

comments to determine whether any changes to the SORN are necessary. If the agency

determines that significant changes to the SORN are necessary, the agency shall publish a 

revised SORN. If the agency determines that significant changes to the routine uses or 

additional routine uses are necessary, the agency shall provide an additional 30-day public 

comment and review period. 

f. Rescindment of a System of Records Notice. When an agency stops maintaining a 

previously established system of records, the agency shall publish a notice of rescindment in 

the Federal Register. Each notice of rescindment shall be drafted using the Office of the 

Federal Register Notice of Rescindment Template, which is provided in Appendix IV to this 

Circular. The notice of rescindment shall identify the system of records, explain why the 

SORN is being rescinded, and provide an account of what will happen to the records that 

 27 The exception to this requirement is in the case of a SORN for a government-wide system of records. For a 

government-wide system of records, the agency with government-wide responsibility shall publish the SORN (see 

section 6(i) of this Circular for information about government-wide systems of records). 28 Agencies may not publish a SORN in the Federal Register until they have provided advance notice of the proposal 

to OMB and Congress pursuant to the reporting instructions in section 7 of this Circular.

29 New routines uses include any routine uses that the agency is newly applying to the specific system, including 

routine uses that may already have been established for other systems of records. 30 See 5 U.S.C. § 552a(e)(11). 31 See id. 
8

were previously maintained in the system. If the records in the system of records will be

combined with another system of records or maintained as part of a new system of records, 

the notice of rescindment shall direct members of the public to the SORN for the system that 

will include the relevant records. 

There are many reasons why agencies may need to rescind a SORN. For example, the 

Privacy Act provides that an agency may only collect or maintain in its records information 

about individuals that is relevant and necessary to accomplish a purpose that is required by 

statute or executive order.32 If a system of records is comprised of records that no longer 

meet that standard, the Privacy Act may require that the agency stop maintaining the system 

and expunge the records in accordance with the requirements in the SORN and the applicable 

records retention or disposition schedule approved by the National Archives and Records 

Administration. 

g. Format and Style of a System of Records Notice. Agencies shall draft SORNs in plain 

language with an appropriate level of detail to ensure that the public is properly informed 

about the character of the system of records.33 Agencies shall follow the publication format 

in the Office of the Federal Register SORN templates, which are provided in the appendices 

to this Circular. In addition, agencies shall consult the Office of the Federal Register’s 

Document Drafting Handbook for general guidance on drafting Federal Register notices.34

h. Scope of a System of Records. The Privacy Act requires agencies to publish a separate 

SORN for each system of records. Before developing a SORN, agencies shall carefully 

consider the proper scope of the system of records. Agencies have discretion in determining 

what constitutes a system of records for purposes of preparing a notice.35 However, agencies 

shall consider the following general factors when determining whether a group of records 

will be treated as a single system or multiple systems for the purposes of the Privacy Act:

(1) The agency’s ability to comply with the requirements of the Privacy Act and facilitate 

the exercise of the rights of individuals.

36

(2) The informative value of the notice. Agencies shall consider whether a single SORN

or multiple SORNs would provide the most informative notice to the public about the 

existence and character of the system(s).

37

 32 See id. § 552a(e)(1). 33 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,962 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 34 Document Drafting Handbook, Office of the Federal Register, National Archives and Records Administration, 

available at http://www.archives.gov/federal-register/write/handbook/. 35 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,952, 28,962-63 (July 9, 

1975), available at

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 36 See id. 37 See id. at 28,962-63.
9

(3) The agency’s ability to be responsive to individual access requests. Agencies shall 

consider whether a single SORN or multiple SORNs would provide the best notice to 

individuals regarding how and where they may request access to their records 

maintained in the system(s) and would allow the agency to most effectively respond 

to such requests.38

(4) The purpose(s) and use(s) of the records.39 If different groups of records are used for 

distinct purposes, it may be appropriate to treat those different groups of records as 

separate systems. Although different groups of records may serve a general common 

purpose, agencies shall also consider whether different routine uses or security 

requirements apply to the different groups, or whether the groups are regularly 

accessed by different employees of the agency. 

(5) The cost and convenience to the agency, but only to the extent consistent with the 

above considerations regarding compliance and individual rights.40

Considerable latitude is left to agencies in defining the scope or grouping of records that 

constitute a system of records. An agency may choose to consider the entire group of records 

for a particular program as a single system, or the agency may consider it appropriate to 

segment a group of records (e.g., by function or geographic unit) and treat each segment as a 

system of records to provide better notice to the public.41 When an agency chooses to 

segment a group of records into separate systems of records, the agency shall nevertheless 

ensure that the SORN for each segment clearly describes any linkages that exist between the 

different systems of records based on the retrieval of the records. For example, if records 

described in different SORNs are in fact linked together through a central indexing or 

retrieval capability such that an employee or contractor retrieving records described in one 

SORN would necessarily also retrieve and gain access to records described in another SORN, 

the agency shall explain this linkage in the “Policies and Practices for Retrieval of Records” 

section of both SORNs.

i. Government-Wide System of Records. A government-wide system of records is a system of 

records where one agency has regulatory authority over records in the custody of multiple 

agencies, and the agency with regulatory authority publishes a SORN that applies to all of the 

records regardless of their custodial location. The application of a government-wide SORN 

ensures that privacy practices with respect to the records are carried out uniformly across the 

Federal Government in accordance with the rules of the responsible agency. For a 

government-wide system of records, all agencies – not just the agency with government-wide 

responsibilities – are responsible for complying with the terms of the SORN and the 

applicable requirements in the Privacy Act, including the access and amendment provisions 

that apply to records under an agency’s control. 

 38 See id. 39 See id. 40 See id. at 28,952. 41 See id. 
10

As a general matter, a government-wide system of records is appropriate when one agency 

has government-wide responsibilities that involve administrative or personnel records 

maintained by other agencies. For example, the Office of Personnel Management has 

published a number of government-wide SORNs relating to the operation of the Federal 

Government’s personnel programs. Agencies shall coordinate with OIRA whenever they are 

considering the need for a new government-wide system of records.

All government-wide systems of records necessarily affect multiple agencies that will have 

custody of the records in the system. Accordingly, one step of OMB’s review of a new or 

modified government-wide system of records will involve an interagency review process that 

allows other affected agencies to review the proposal and provide comments. Once the

agency with regulatory authority has published a government-wide SORN, no other agency 

shall publish a SORN that duplicates the existing government-wide SORN, unless such 

publication has been approved by OMB. 

j. System of Records Operated by a Contractor.

42 When an agency provides by contract for 

the operation by or on behalf of the agency of a system of records to accomplish an agency 

function, the agency shall cause the requirements of the Privacy Act to be applied to the 

system, limited only by the agency’s authority to do so.43 In such cases, the system operated 

by the contractor is, in effect, deemed to be maintained by the agency.44 The agency shall 

publish a SORN for the system, establish an appropriate routine use to permit disclosure of 

records to the contractor for the purpose of operating the system, and, to the extent consistent 

with the agency’s authority, incorporate enforceable clauses in the contract and statement of 

work to ensure that the contractor complies with all applicable requirements of the statute 

and OMB policies. 

Agencies shall design their procurement practices to ensure that all contracts that involve the 

creation, collection, use, processing, storage, maintenance, dissemination, disclosure, or 

disposal of information that identifies and is about individuals are reviewed and approved by 

the Senior Agency Official for Privacy before award to help evaluate whether a system of 

records will be established and, if so, to include appropriate clauses in the contract.45 The 

Senior Agency Official for Privacy shall have access to a complete and accurate list of all of 

the agency’s contracts involving information that identifies and is about individuals, and 

shall establish a process to ensure that the language of each contract is sufficient and that the 

applicable requirements in the Privacy Act and OMB policies are enforceable on the 

contractor and its employees consistent with the agency’s authority. 

 42 In cases where an agency acts as a service provider for one or multiple agencies, all agencies involved must ensure 

compliance with applicable Privacy Act requirements. 43 See 5 U.S.C. § 552a(m). 44 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,976 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 45 See id.
11

k. Routine Uses. A routine use is a particular kind of disclosure of a record outside of the 

agency maintaining the system of records.

46 To qualify as a routine use, the disclosure must 

be for a purpose that is compatible with the purpose for which the information was originally 

collected.47 The routine use provision of the Privacy Act functions as one of the exceptions 

to the statute’s general prohibition against the disclosure of a record without the written 

consent of the individual to whom the record pertains.48 

The Privacy Act requires agencies to describe each routine use of the records contained in the 

system of records, including the categories of users of the records and the purpose of the 

use.49 Agencies may only establish routine uses for a system by explicitly publishing the 

routine uses in the relevant SORN.50 Agencies are strongly encouraged to publish all routine 

uses applicable to a system of records in a single Federal Register notice for that system. 

However, some agencies choose to publish a separate notice of routine uses that are 

applicable to many systems of records at the agency, and then incorporate them by reference 

into the notices for specific systems to which they apply. When incorporating such routine 

uses by reference, agencies shall ensure that the routine use section of the SORN clearly 

indicates which of the separately published routine uses apply to the system of records and 

includes the Federal Register citation where they have been published. 

Routine uses shall be narrowly tailored to address a specific and appropriate use of the 

records. Agencies shall describe each routine use with sufficient clarity and specificity to 

ensure that members of the public who are unfamiliar with the system or the agency’s 

program can understand the uses to which the records are subject.51 Overly broad or 

ambiguous language would undermine the purpose of the routine use notice requirement and 

shall be avoided. A routine use that only applies to certain records in a system of records 

should indicate its limited scope. 

Before establishing a routine use, an agency must determine that it has the necessary 

authority to make disclosures under the routine use and that the routine use is appropriate. 

As explained in OMB’s Privacy Act Guidelines, a routine use may be appropriate when the 

use of the record is necessary for the efficient conduct of government, and when the use is 

both related to and compatible with the original purpose for which the information was 

collected (e.g., the development of a sampling frame for an evaluation study or other 

statistical purposes).

52 Moreover, the concept of compatibility comprises both functionally 

equivalent uses of the information as well as other uses of the information that are necessary

and proper (e.g., a disclosure to the National Archives and Records Administration to 

 46 See Implementation of the Privacy Act of 1974: Supplementary guidance, 40 Fed. Reg. 56,741, 56,742 (Dec. 4, 

1975), available at https://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation1974.pdf. 47 See 5 U.S.C. § 552a(a)(7). 48 See id. § 552a(b)(3).

49 See id. § 552a(e)(4)(D). 50 See id. 51 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,963 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 52 See id. at 28,953-54. 
12

conduct records management activities pursuant to specific statutory authority).53 

Agencies shall publish notice of any new or significantly modified routine uses sufficiently 

in advance of the proposed effective date of the routine uses to permit time for the public to 

comment and for the agency to review those comments.54 In all cases, the Privacy Act 

requires agencies to publish any new or modified routine use at least 30 days before the 

effective date of the routine use.55 An agency shall not disclose any records pursuant to a 

new or modified routine use until after the 30-day comment period has ended and the agency 

has considered any comments from the public and determined that no further modifications 

are necessary. 

If an agency determines that an existing routine use is no longer necessary or appropriate, the 

agency shall immediately discontinue all disclosures under the routine use and shall publish a 

revised SORN in the Federal Register rescinding the routine use. Moreover, if an agency 

determines that the routine uses in a SORN do not accurately and completely describe all

routine use disclosures to which the records in the system are subject, the agency shall

discontinue any disclosures that are not accurately and completely described and revise the 

routine uses in the SORN to accurately and completely describe those disclosures. 

l. Information Collections and Privacy Act Statements. If an agency will be collecting 

information as part of a new or modified system of records, the agency may need to comply 

with additional requirements, including those in the Paperwork Reduction Act,56 the EGovernment Act of 2002,57 and related OMB guidance. Agencies (and their contractors) 

shall meet all applicable requirements before they begin collecting the information. For 

guidance on whether and how these statutes and OMB policies apply to a collection activity, 

agencies shall consult OMB guidance and contact OIRA. 

Moreover, if an agency asks individuals to supply information that will become part of a 

system of records, the agency is required to provide a Privacy Act statement on the form used 

to collect the information or on a separate form that can be retained by the individual.58 The 

agency shall provide a Privacy Act statement in such circumstances regardless of whether the 

information will be collected on a paper or electronic form, on a website, on a mobile 

application, over the telephone,59 or through some other medium. This requirement ensures 

that the individual is provided with sufficient information about the request for information 

 53 See Guidance on the Privacy Act Implications of “Call Detail” Programs to Manage Employees’ Use of the 

Government’s Telecommunications Systems, 52 Fed. Reg. 12,990, 12,993 (Apr. 20, 1987), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance_privacy_act.pdf. 54 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,966 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 55 See 5 U.S.C. § 552a(e)(11). 56 44 U.S.C. §§ 3501-3521. 57 44 U.S.C. § 3501 note. 58 See 5 U.S.C. § 552a(e)(3).

59 When information is collected over the telephone, the agency shall orally provide the required information and 

provide a means by which the individual can receive the information in writing. 
13

to make an informed decision on whether or not to respond.60

The Privacy Act statement shall include a plain-language description of: 

(1) the authority (whether granted by statute or executive order) that authorizes the 

solicitation of the information and whether disclosure of such information is 

mandatory or voluntary; 

(2) the principal purpose(s) for which the information is intended to be used; 

(3) the published routine uses to which the information is subject;

61 

(4) the effects on the individual, if any, of not providing all or any part of the requested 

information; and 

(5) an appropriate citation (and, if practicable, a link) to the relevant SORN(s).

7. Reporting Systems of Records to OMB and Congress

a. General. The Privacy Act requires each agency that proposes to establish or significantly 

modify a system of records to provide adequate advance notice of any such proposal to 

OMB, the Committee on Oversight and Government Reform of the House of 

Representatives, and the Committee on Homeland Security and Governmental Affairs of the 

Senate.62 This advance notice is separate from the public comment period for new or 

modified routine uses required by subsection (e)(11) of the Privacy Act and discussed in 

section 6 of this Circular. Agencies provide advance notice to OMB and the committees of 

jurisdiction in Congress in order to permit an evaluation of the probable or potential effect of 

such a proposal on the privacy or other rights of individuals.63

b. Advance Notice of a New or Modified System of Records. Agencies shall report to OMB 

and Congress any proposal to establish or significantly modify a system of records at least 30 

days prior to the submission of the notice to the Federal Register for publication. OMB will 

have 30 days to review the proposal and provide any comments to the agency. The 30-day 

review period is separate from – and may not run concurrently with – the publication period 

in the Federal Register. Only significant changes to a system of records that require a 

 60 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,961 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 61 When describing the routine uses in the Privacy Act statement, agencies shall tailor the scope and content of the 

description in order to provide the most effective notice to the public. Agencies generally need not restate the full 

text of the published routine uses or provide a lengthy list of routine uses to which the information is subject. 

Rather, agencies may provide a plain-language summary of the routine uses and provide a link to the website where 

the full list of routine uses is available. See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. 

Reg. 28,948, 28,961-62 (July 9, 1975), available at

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 62 See 5 U.S.C. § 552a(r). 63 See id.
14

revision to the SORN, as described in section 6 of this Circular, need to be reported to OMB 

and Congress; changes that are not significant do not need to be reported. 

Advance notice to OMB and Congress is required by subsection (r) of the Privacy Act. The 

purpose of the advance notice to OMB and Congress is to permit an evaluation of the 

potential effect of the proposal on the privacy and other rights of individuals.64 Although the 

review period will generally require no more than 30 days, OMB has the discretion to extend 

the 30-day review period based on the specific circumstances of the proposal. If an agency 

has questions about the timing of the review, the agency shall consult with OIRA. 

In circumstances where it is not feasible for the agency to wait until the 30-day review period 

for OMB and Congress has expired to publish the notice in the Federal Register, the agency 

may submit a formal written request from the Senior Agency Official for Privacy to OIRA

for an expedited advance review period (see section 7(d) of this Circular for information 

about expedited review requests).

Illustration of Standard Review Process for Systems of Records65

Agency Action Explanation Timing

The agency submits report to 

OMB and Congress at least 30 

days before publication of the 

notice in the Federal Register. 

OMB and Congress have the 

opportunity to evaluate the 

probable or potential effect of 

such a proposal on the privacy 

or other rights of individuals.

Day 1

After incorporating any 

comments from OMB – and 

unless OMB provides 

instructions to the contrary – 

the agency may publish the 

notice in the Federal Register

and solicit comments from the 

public. 

Notices published in the 

Federal Register after review 

by OMB and Congress are 

effective upon publication, 

with the exception of any new 

or modified routine uses. New 

or modified routine uses 

require a minimum of 30 days 

after publication in the Federal 

Register before they can 

become effective.

Day 31

The 30-day public comment 

period closes and the agency 

reviews and considers any 

comments received. If no 

changes to the notice are 

necessary, the notice remains 

effective and any new or 

modified routine uses become

effective.

If the agency receives public 

comments, the agency shall 

review the comments to 

determine whether any changes 

to the notice are necessary. If 

the agency determines that 

significant changes are 

necessary, the agency will need 

to begin the review process 

again.

Day 61

 64 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,977 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 65 OMB is providing this table to illustrate the steps of the standard review process. The actual timing of the process 

will depend on the specific circumstances of the proposal, the agency’s internal review and clearance procedures, 

the review process for any Privacy Act exemption rules, and the logistics of Federal Register publication.
15

c. Instructions for Reporting a New or Modified System of Records. Agencies are required to 

report to OMB and Congress any proposal to establish or significantly modify a system of 

records. Agencies shall report proposals to the committees of jurisdiction in Congress by 

messenger or by mailing the reports to the addresses provided below. Agencies shall report 

proposals to OMB using OMB’s specific web-based portal, as described below. Agencies 

shall not mail or messenger paper versions of the report to OMB. Submission of the report to 

OMB will officially start the 30-day advance review period. 

(1) House of Representatives. Agencies shall submit reports to the chair of the House 

Committee on Oversight and Government Reform, 2157 Rayburn House Office 

Building, Washington, DC 20515. 

(2) Senate. Agencies shall submit reports to the chair of the Senate Committee on 

Homeland Security and Governmental Affairs, 340 Dirksen Senate Office Building, 

Washington, DC 20510. 

(3) OMB. Agencies shall submit reports to OMB using the web-based portal jointly 

developed by OIRA and the General Services Administration’s (GSA) Regulatory 

Information Service Center (RISC). This web-based portal, the RISC/OIRA 

Consolidated Information System (ROCIS), was developed to facilitate the 

submission and review of regulations and other agency materials.66 For detailed 

instructions on how to use ROCIS to submit reports to OMB, agencies shall consult 

the user manuals available on the ROCIS website or register for the training classes 

conducted by RISC at GSA headquarters.

67

d. Request for Expedited Review of a New or Modified System of Records. Although agencies 

are required to provide adequate advance notice of any proposal to establish or significantly 

modify a system of records, there may be circumstances where it is not feasible for the 

agency to wait until the 30-day review period has expired to publish a notice in the Federal 

Register. In such cases, the agency may submit a formal written request from the Senior 

Agency Official for Privacy to OIRA for an expedited OMB review period. The request 

shall be included in the transmittal letter that the agency submits to OIRA in ROCIS. The 

request shall demonstrate the agency’s specific and compelling need for the expedited 

review, indicate why the agency cannot meet the established review period, and explain the 

consequences if the request is not granted. 

When OIRA grants an agency’s request for expedited review, the agency will be allowed to 

publish the notice in the Federal Register after the expedited OMB review period. When 

OIRA does not grant an agency’s request for expedited review, the normal OMB review 

process will proceed. Agencies shall note that OMB may not waive the explicit requirement

 66 See RISC/OIRA Consolidated Information System (ROCIS), available at https://www.rocis.gov/. 67 All ROCIS user manuals and training information are available on the ROCIS website at 

https://www.rocis.gov/rocis/login.do.
16

in the Privacy Act for a 30-day Federal Register public notice before the adoption of a new 

or modified routine use,68 nor may OMB waive the adequate advance notice that is required 

to Congress.69

e. Content of the Report of a New or Modified System of Records. The report of a new or 

significantly modified system of records includes a transmittal letter, a narrative statement, a 

draft Federal Register notice, any Privacy Act exemption rules, and any supplementary 

documents. 

(1) Transmittal Letter. The transmittal letter serves as a brief cover letter accompanying 

the report. The transmittal letter shall: 

(A) Be signed by the Senior Agency Official for Privacy. 

(B) Contain the name, email address, and telephone number of the individual who 

can best answer questions about the proposed system of records. 

(C) Contain the agency’s assurance that the proposed system of records fully 

complies with the Privacy Act and OMB policies. 

(D) Contain the agency’s assurance that the proposed system of records does not 

duplicate any existing agency or government-wide systems of records. 

(2) Narrative Statement. The narrative statement provides a brief overview of the 

proposed system of records making reference to the other materials in the report 

without simply restating information provided in those materials. The narrative 

statement shall: 

(A) Describe the purpose(s) for which the agency is establishing or modifying the 

system of records and explain how the scope of the system is commensurate 

with the purpose(s) of the system. 

(B) Identify the specific authority (statute or executive order) under which the 

system of records will be maintained. The agency shall avoid citing authority 

that is overly general; rather, the agency shall cite the specific programmatic 

authority for collecting, maintaining, using, and disseminating the 

information. 

(C) An evaluation of the probable or potential effect of the proposal on the 

privacy of individuals whose information will be maintained in the system of 

records.70 If the agency has conducted one or more privacy impact 

assessment(s) with respect to information technology that will be used to 

 68 See 5 U.S.C. § 552a(e)(11). 69 See id. § 552a(r). 70 5 U.S.C. § 552a(r) provides that agencies report a proposal to OMB and Congress in order to permit an evaluation of 

the probable or potential effect of such proposal on the privacy or other rights of individuals.
17

collect, maintain, or disseminate the information in the system of records, the 

privacy impact assessment(s) will likely provide the information necessary to 

meet this requirement, and may be submitted in lieu of drafting a separate 

evaluation. 

(D) Explain how each new or modified routine use satisfies the compatibility 

requirement of the Privacy Act.71 

(E) Identify any information collections approved by OMB or submitted to OMB 

for approval that will be used to collect information that will be maintained in 

the system of records, and provide the relevant names, OMB control numbers, 

and expiration dates. If the request for OMB approval of an information 

collection is pending, the agency may simply state the name of the collection 

and the date it was submitted to OMB for review. 

(3) Federal Register Notice. The draft new or revised notice in the format prescribed by 

the Office of the Federal Register SORN templates, which are provided in the 

appendices to this Circular. 

(4) Exemption Rule. Any new Privacy Act exemption rules or changes to published 

exemption rules in Federal Register format that the agency proposes to issue that will 

apply to records in the new or significantly modified system of records. 

(5) Supplementary Documents. The supplementary documents include: 

(A) For significantly modified systems, the agency shall include a list of the 

substantive changes to the previously published version of the notice and/or a 

version of the previously published notice that has been marked up to show 

the changes that are being proposed.

(B) The agency shall include any other supplementary documents requested by 

OMB.

f. Reporting General Changes to Multiple Systems of Records. When an agency makes a 

general change to agency programs or information technology that applies in a similar way to

multiple systems of records (e.g., enabling remote access to systems, moving systems from a 

conventional data center to a cloud-based storage environment, adding a routine use to all 

systems of records), the agency may submit a single, consolidated report to OMB and 

Congress describing the changes. However, the agency shall ensure that any changes are 

properly reflected in all published SORNs. 

 71 See 5 U.S.C. § 552a(a)(7).
18

8. Publishing Matching Notices

a. General. The Privacy Act requires recipient agencies (or source agencies in a matching 

program where a non-Federal agency is the recipient agency) to publish a notice in the 

Federal Register upon the establishment, re-establishment,

72 or modification of a matching 

program.73 A matching notice identifies the agencies involved, the purpose(s) of the 

matching program, the authority for conducting the matching program, the records and 

individuals involved, and additional details about the matching program. The requirement 

for agencies to publish a matching notice allows the Federal Government to foster 

transparency and accountability with respect to agencies’ matching programs. 

b. When to Publish a Matching Notice. Agencies are required to publish a matching notice in 

the Federal Register at least 30 days prior to the establishment, re-establishment, or 

significant modification of the matching program.74 Notice is not required for the one-year 

renewal of a matching program by the agency’s Data Integrity Board.75 If the agency is reestablishing a matching program and continuing the program past the expiration of the 

current matching agreement (including any one-year renewal approved by the Data Integrity 

Board), the agency shall publish a notice of the re-establishment at least 30 days prior to the 

expiration of the existing matching agreement.

Agencies are only required to publish a revised matching notice when they are making 

significant changes to the matching program. As a general matter, significant changes are 

those that are substantive in nature and therefore warrant a revision of the matching notice in 

order to provide notice to the public of the modified matching program. The following are 

examples of significant changes: 

(1) A change that modifies the purpose(s) of the matching program. 

(2) A change in the agency’s authority to conduct the matching program. 

(3) A change that expands the types or categories of records that are used in the matching 

program, or a significant increase in the number of records that are being matched. 

(4) A change that expands the categories of individuals whose records are used in the 

matching program.

 72 The re-establishment of a matching program occurs when an agency re-establishes a matching program upon the 

expiration of a matching agreement. The re-establishment of a matching program requires the publication of a 

matching notice in the Federal Register and needs to be reported to OMB and Congress (see section 9 of this 

Circular for information about reporting matching programs). In contrast, the renewal of a matching program 

occurs when an agency’s Data Integrity Board renews a matching agreement for one additional year pursuant to 5 

U.S.C. § 552a(o)(2)(D). The renewal of a matching program does not require the publication of a matching notice 

and does not need to be reported to OMB or Congress. 73 See 5 U.S.C. § 552a(e)(12). 74 See id. 75 See id. § 552a(o)(2)(D).
19

(5) A change to the source and/or recipient agencies that are involved in the matching 

program. 

This is not an exhaustive list of significant changes that would require a revised matching 

notice. Other changes to a matching program would require a revised notice if the changes 

are substantive in nature and therefore warrant additional notice. If an agency has questions 

about whether particular changes to a matching program are significant, the agency shall 

contact OIRA for assistance.

c. What to Publish in a Matching Notice. Each matching notice shall be drafted using the 

Office of the Federal Register matching notice templates, which are provided in the 

appendices to this Circular. When an agency establishes or re-establishes a matching 

program, the matching notice is comprised of a single Federal Register notice that includes 

all of the required elements that are identified in Appendix V to this Circular, Office of the 

Federal Register Matching Notice Template – Full Notice. When an agency modifies an 

existing matching program, the agency may choose to publish a Federal Register notice that 

includes all of the required elements identified in Appendix V, or a notice that includes the 

elements that are identified in Appendix VI to this Circular, Office of the Federal Register 

Matching Notice Template – Notice of Revision, as well as any other elements that are being 

revised. 

d. Who Publishes a Matching Notice. The recipient agency (or source agency in a matching 

program where a non-Federal agency is the recipient agency) is responsible for meeting the 

publication requirements associated with a matching program. However, where a recipient 

agency is not the actual beneficiary of the matching program, it may, to the extent legally

permissible, negotiate with the actual beneficiary agency for reimbursement of the costs

incurred in publishing the matching notice. Publication shall occur at the agency level, rather 

than the sub-agency, component, or program level. If a matching program will be conducted 

by a sub-agency or component of an agency, the broader agency shall publish the matching 

notice and specify the sub-agency or component that will conduct the program. 

e. Timing of a Matching Notice.

76 A new or revised matching notice is not effective until at 

least 30 days after its publication in the Federal Register. If an agency receives public 

comments on a published matching notice, the agency shall review the comments to 

determine whether any changes to the matching notice are necessary. If the agency 

determines that significant changes to the matching notice are necessary, the agency shall 

publish a revised matching notice and provide an additional 30-day public comment and 

review period. 

f. Format and Style of a Matching Notice. Agencies shall draft matching notices in plain 

language with an appropriate level of detail to ensure that the public is properly informed 

about the matching program. Agencies shall follow the publication format in the Office of 

the Federal Register matching notice templates, which are provided in the appendices to this 

 76 Agencies may not publish a matching notice in the Federal Register until they have provided advance notice of the 

proposal to OMB and Congress pursuant to the reporting instructions in section 9 of this Circular.
20

Circular. In addition, agencies shall consult the Office of the Federal Register’s Document 

Drafting Handbook for general guidance on drafting Federal Register notices.77

9. Reporting Matching Programs to OMB and Congress

a. General. The Privacy Act requires each agency that proposes to establish, re-establish, or 

significantly modify a matching program to provide adequate advance notice of any such 

proposal to OMB, the Committee on Oversight and Government Reform of the House of 

Representatives, and the Committee on Homeland Security and Governmental Affairs of the 

Senate.78 This advance notice is separate from the public comment period for matching 

notices required by subsection (e)(12) of the Privacy Act and discussed in section 8 of this 

Circular. Agencies provide advance notice to OMB and the committees of jurisdiction in 

Congress in order to permit an evaluation of the probable or potential effect of such a 

proposal on the privacy or other rights of individuals.79

b. Advance Notice of a New or Modified Matching Program. Agencies shall report to OMB 

and Congress any proposal to establish, re-establish, or significantly modify a matching 

program at least 30 days prior to the submission of the notice to the Federal Register for 

publication. If the agency is re-establishing a matching program and continuing the program 

past the expiration of the current matching agreement (including any one-year renewal 

approved by the Data Integrity Board), the agency shall report the proposal to re-establish the 

matching program at least 60 days prior to the expiration of the existing matching agreement. 

OMB will have 30 days to review the proposal to establish, re-establish, or significantly 

modify a matching program and provide any comments to the agency. This 30-day review 

period is separate from – and may not run concurrently with – the publication period in the 

Federal Register. Only significant changes to a matching program that require a revision to 

the matching notice, as described in section 8 of this Circular, need to be reported to OMB 

and Congress; changes that are not significant do not need to be reported. 

Advance notice to OMB and Congress is required by subsection (r) of the Privacy Act. The 

purpose of the advance notice to OMB and Congress is to permit an evaluation of the 

potential effect of the proposal on the privacy and other rights of individuals.80 Although the 

review period will generally require no more than 30 days, OMB has the discretion to extend 

the 30-day review period based on the specific circumstances of the proposal. If an agency 

has questions about the timing of the review, the agency shall consult with OIRA. 

 77 Document Drafting Handbook, Office of the Federal Register, National Archives and Records Administration, 

available at http://www.archives.gov/federal-register/write/handbook/. 78 See 5 U.S.C. § 552a(r). 79 See id. 80 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,977 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.
21

Illustration of Standard Review Process for Matching Programs81

Agency Action Explanation Timing

The agency submits report to 

OMB and Congress at least 30 

days before publication of the 

notice in the Federal Register, 

and at least 60 days before the 

expiration of the matching 

agreement in the case of a reestablished matching program.

OMB and Congress have the 

opportunity to evaluate the 

probable or potential effect of 

such a proposal on the privacy 

or other rights of individuals.

Day 1

After incorporating any 

comments from OMB – and 

unless OMB provides 

instructions to the contrary – 

the agency may publish the 

notice in the Federal Register

and solicit comments from the 

public.

Matching notices published in 

the Federal Register are not 

effective until a minimum of 

30 days after publication.

Day 31

The 30-day public comment 

period closes and the agency 

reviews and considers any 

comments received. If no 

changes to the notice are 

necessary, the notice is 

effective.

If the agency receives public 

comments, the agency shall 

review the comments to 

determine whether any changes 

to the notice are necessary. If 

the agency determines that 

significant changes are 

necessary, the agency will need 

to begin the review process 

again.

Day 61

c. Instructions for Reporting a New or Modified Matching Program. Agencies are required to 

report to OMB and Congress any proposal to establish, re-establish, or significantly modify a 

matching program. Agencies shall report proposals to the committees of jurisdiction in 

Congress by messenger or by mailing the reports to the addresses provided below. Agencies 

shall report proposals to OMB using OMB’s specific web-based portal, as described below. 

Agencies shall not mail or messenger paper versions of the report to OMB. Submission of 

the report to OMB will officially start the 30-day advance review period. 

(1) House of Representatives. Agencies shall submit reports to the chair of the House 

Committee on Oversight and Government Reform, 2157 Rayburn House Office 

Building, Washington, DC 20515. 

 81 OMB is providing this table to illustrate the steps of the standard review process. The actual timing of the process 

will depend on the specific circumstances of the proposal, the agency’s internal review and clearance procedures, 

and the logistics of Federal Register publication.
22

(2) Senate. Agencies shall submit reports to the chair of the Senate Committee on 

Homeland Security and Governmental Affairs, 340 Dirksen Senate Office Building, 

Washington, DC 20510. 

(3) OMB. Agencies shall submit reports to OMB using the web-based portal jointly 

developed by OIRA and RISC. This web-based portal, called ROCIS, was developed 

to facilitate the submission and review of regulations and other agency materials.82 

For detailed instructions on how to use ROCIS to submit reports to OMB, agencies 

shall consult the user manuals available on the ROCIS website or register for the 

training classes conducted by RISC at GSA headquarters.83

d. Request for Expedited Review of a New or Modified Matching Program. Although 

agencies are required to provide adequate advance notice of any proposal to establish, reestablish, or significantly modify a matching program, there may be circumstances where it 

is not feasible for the agency to wait until the 30-day review period has expired to publish a 

notice in the Federal Register. In such cases, the agency may submit a formal written 

request from the Senior Agency Official for Privacy to OIRA for an expedited OMB review 

period. The request shall be included in the transmittal letter that the agency submits to 

OIRA in ROCIS. The request shall demonstrate the agency’s specific and compelling need 

for the expedited review, indicate why the agency cannot meet the established review period, 

and explain the consequences if the request is not granted. 

When OIRA grants an agency’s request for expedited review, the agency will be allowed to 

publish the notice in the Federal Register after the expedited OMB review period. When 

OIRA does not grant an agency’s request for expedited review, the normal OMB review 

process will proceed. Agencies shall note that OMB may not waive the explicit requirement 

in the Privacy Act for a 30-day Federal Register public notice before conducting a new or 

significantly modified matching program,

84 nor may OMB waive the adequate advance 

notice that is required to Congress.85

e. Content of the Report of a New or Modified Matching Program. The report of an 

established, re-established, or significantly modified matching program includes a transmittal 

letter, a narrative statement, a draft Federal Register notice, a matching agreement, and any 

supplementary documents. 

(1) Transmittal Letter. The transmittal letter serves as a brief cover letter accompanying 

the report. The transmittal letter shall: 

(A) Be signed by the Senior Agency Official for Privacy or the chairman of the 

Data Integrity Board. 

 82 See RISC/OIRA Consolidated Information System (ROCIS), available at https://www.rocis.gov/. 83 All ROCIS user manuals and training information are available on the ROCIS website at 

https://www.rocis.gov/rocis/login.do. 84 See 5 U.S.C. § 552a(e)(12). 85 See id. § 552a(r).
23

(B) Contain the name, email address, and telephone number of the individual who 

can best answer questions about the proposed matching program. 

(C) Contain the agency’s assurance that the proposed matching program was 

approved by the agency’s Data Integrity Board and fully complies with the 

Privacy Act and OMB policies. 

(2) Narrative Statement. The narrative statement provides a brief overview of the 

proposed matching program making reference to the other materials in the report 

without simply restating information provided in those materials. The narrative 

statement shall:

(A) Describe the purpose(s) for which the agency is establishing, re-establishing, 

or significantly modifying the matching program.

(B) Identify the specific authority (statute or executive order) under which the 

agency is conducting the matching program. The agency shall avoid citing 

authority that is overly general; rather, the agency shall cite the specific 

programmatic authority for conducting the matching program. 

(C) Describe the administrative, technical, and physical safeguards in place to 

protect against unauthorized access to records used in the matching program. 

(D) Provide the agency’s specific evaluation of the potential impact on the privacy 

of individuals whose records will be used in the matching program. 

(E) Indicate whether a cost-benefit analysis was performed for the matching 

program, describe the results of the cost-benefit analysis, and explain the basis 

on which the agency is justifying the matching program.

(3) Federal Register Notice. The draft new or revised matching notice in the format 

prescribed by the Office of the Federal Register matching notice templates, which are 

provided in the appendices to this Circular. 

(4) Matching Agreement. The full matching agreement that was approved by the 

agency’s Data Integrity Board.

(5) Supplementary Documents. The supplementary documents include: 

(A) For significantly modified matching programs, the agency shall include a list 

of the substantive changes to the previously published version of the matching 

notice and/or a version of the previously published matching notice that has 

been marked up to show the changes that are being proposed. 

(B) The agency shall include any other supplementary documents requested by 

OMB.
24

10. Privacy Act Implementation Rules

Each agency that maintains a system of records shall promulgate rules, in accordance with the 

rulemaking procedures in 5 U.S.C. § 553, to implement the requirements of the Privacy Act.86 

Privacy Act implementation rules shall provide the public with sufficient information to 

understand how an agency is complying with the law, and provide sufficient information for 

individuals to exercise their rights under the law.87 In particular, agencies’ Privacy Act 

implementation rules shall:

a. establish procedures whereby an individual can be notified in response to his or her request if 

any system of records named by the individual contains a record pertaining to him or her;88

b. define reasonable times, places, and requirements for authenticating the identity of an 

individual who requests his or her record or information pertaining to him or her before the 

agency makes the record or information available to the individual (more rigorous 

authentication procedures may be required for more sensitive records);89

c. establish procedures whereby an individual can be notified at his or her request how the 

individual can gain access to any record pertaining to him or her in the system, including 

special procedures, if deemed necessary, for the disclosure to an individual of medical 

records, including psychological records, pertaining to him or her;90

d. establish procedures for reviewing a request from an individual concerning the amendment of 

any record or information pertaining to him or her, for making a determination on the 

request, for an appeal within the agency of an initial adverse agency determination, and for 

whatever additional means may be necessary for each individual to be able to exercise fully 

his or her rights under the Privacy Act;

91 and

e. establish fees to be charged, if any, to any individual for making copies of his or her record, 

excluding the cost of any search for and review of the record.92

Agencies shall submit proposed and final Privacy Act implementation rules to OMB if those 

rules are subject to OMB review under Executive Order 12866, Regulatory Planning and 

 86 See id. § 552a(f). 87 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,966 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 88 See 5 U.S.C. § 552a(f)(1).

89 See id. § 552a(f)(2).

90 See id. § 552a(f)(3).

91 See id. § 552a(f)(4).

92 See id. § 552a(f)(5).
25

Review,

93 Executive Order 13563, Improving Regulation and Regulatory Review,94 or other 

regulatory review procedures.

11. Privacy Act Exemption Rules

The Privacy Act includes two sets of provisions that allow agencies to claim exemptions from

certain requirements in the statute.

95 These provisions allow agencies in certain circumstances to 

promulgate rules, in accordance with 5 U.S.C. § 553, to exempt a system of records from select 

provisions of the Privacy Act. Agencies that wish to promulgate a rule to exempt a system of 

records shall follow all applicable rulemaking procedures. Generally, these procedures will 

require agencies to publish in the Federal Register a proposed rule soliciting comments from the 

public, followed by a final rule. At a minimum, agencies’ Privacy Act exemption rules shall 

include: 

a. The specific name(s) of any system(s) that will be exempt pursuant to the rule (the name(s) 

shall be the same as the name(s) given in the relevant SORN(s));96

b. The specific provisions of the Privacy Act from which the system(s) of records is to be 

exempted and the reasons for the exemption (a separate reason need not be stated for each 

provision from which a system is being exempted, where a single explanation will serve to 

explain the entire exemption);

97 and

c. An explanation for why the exemption is both necessary and appropriate.98

In addition to promulgating a rule, agencies wishing to claim an exemption for a system of 

records shall also identify the applicable exemption(s) in the relevant SORN. Whenever 

agencies publish a rule to claim a new or revised exemption for a system of records, the agency 

shall also revise the SORN pursuant to the publication requirements described in section 6 of this 

Circular, and report the proposal to OMB and Congress pursuant to the reporting requirements 

described in section 7 of this Circular. 

When agencies wish to promulgate a Privacy Act exemption rule, agencies shall submit the draft 

rule to OMB along with the new or revised SORN(s) associated with the systems that the agency 

wishes to exempt (see section 7 of this Circular for information about reporting a new or 

modified system of records). In most cases a separate submission of the rule to OMB will not be 

required and OMB will review the proposed exemption rule along with the SORN. However, in 

 93 Exec. Order No. 12,866, 58 Fed. Reg. 51,735 (1993), available at

http://www.reginfo.gov/public/jsp/Utilities/EO_12866.pdf. 94 Exec. Order No. 13,563, 76 Fed. Reg. 3,821 (2011), available at 

http://www.reginfo.gov/public/jsp/Utilities/EO_13563.pdf. 95 See 5 U.S.C. § 552a(j) and (k). 96 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,971-72 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 97 See id.

98 See id. at 28,971.
26

some exceptional cases exemption rules may also be subject to OMB’s regulatory review 

procedures under Executive Order 12866, Regulatory Planning and Review,

99 and Executive 

Order 13563, Improving Regulation and Regulatory Review.

100 In such cases, OIRA will notify 

the agency as soon as possible regarding the appropriate review process. 

It is important for agencies to recognize that Privacy Act exemptions are permissive. Even in 

circumstances where an agency is authorized to promulgate an exemption, the agency shall only 

do so if the exemption is necessary and consistent with established policies.101 Moreover, while 

the Privacy Act allows agencies to promulgate exemptions that apply at the system level, 

agencies shall exempt only those records in a system of records for which the exemption is 

necessary and appropriate.102 In cases where it is necessary to maintain exempt and non-exempt 

records in a single system of records, agencies shall only exempt the records for which the 

exemption is necessary and appropriate.103

Agencies may not exempt any system of records from any provision of the Privacy Act until all 

of the applicable reporting and publication requirements have been met.

12. Privacy Act Reviews

OMB Circular A-130104 outlines privacy requirements that apply to the information system 

development life cycle. Because all information in systems of records is part of one or more 

information systems,105 many of the requirements in Circular A-130 apply to systems of records. 

For example, agencies are required to select, implement, and assess privacy controls106 and 

develop privacy plans107 for information systems. In addition, agencies are required to establish 

and maintain an agency-wide privacy continuous monitoring (PCM) program,108 based on a 

 99 Exec. Order No. 12,866, 58 Fed. Reg. 51,735 (1993), available at

http://www.reginfo.gov/public/jsp/Utilities/EO_12866.pdf. 100 Exec. Order No. 13,563, 76 Fed. Reg. 3,821 (2011), available at 

http://www.reginfo.gov/public/jsp/Utilities/EO_13563.pdf. 101 See Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,972 (July 9, 1975), 

available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 102 See id. at 28,971. 103 See id. 104 OMB Circular No. A-130, Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. 105 The term “information system” means a discrete set of information resources organized for the collection, 

processing, maintenance, use, sharing, dissemination, or disposition of information. 44 U.S.C. § 3502(8). The term 

“information resources” means information and related resources, such as personnel, equipment, funds, and 

information technology. 44 U.S.C. § 3502(6). 106 A privacy control is an administrative, technical, or physical safeguard employed within an agency to ensure 

compliance with applicable privacy requirements and manage privacy risks. 107 A privacy plan is a formal document that details the privacy controls selected for an information system or 

environment of operation that are in place or planned for meeting applicable privacy requirements and managing 

privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that 

will be used to assess the controls. 108 A PCM program is an agency-wide program that maintains ongoing awareness of threats and vulnerabilities that 

may pose privacy risks; monitors changes to information systems and environments of operation that create, collect, 

use, process, store, maintain, disseminate, disclose, or dispose of personally identifiable information; and conducts 
27

written PCM strategy.109 The requirement to establish and maintain a PCM program has 

replaced the prior OMB requirement for agencies to conduct annual Privacy Act reviews.

During the development of an information system, agencies shall select, implement, and assess 

privacy controls that allow the agency to ensure continued compliance with all applicable

requirements in the Privacy Act and related OMB guidance. Furthermore, agencies shall 

monitor and assess privacy controls selected for an information system on an ongoing basis. 

This includes assessing the effectiveness of the privacy controls, documenting changes to the 

information system, analyzing the privacy impact associated with the changes, and reporting the 

state of the information system to appropriate agency officials. The type, rigor, and frequency of 

control assessments shall be sufficient to account for risks that change over time based on 

changes in the threat environment, agency missions and business functions, personnel, 

technology, or environments of operation. 

Agencies shall design their privacy control selection process to include privacy controls that 

allow the agency to ensure compliance with applicable requirements in the Privacy Act and 

related OMB guidance. At a minimum, the controls selected for an information system that 

contains information in a system of records shall address the following elements: 

a. Minimization. Agencies shall ensure that no system of records includes information about an 

individual that is not relevant and necessary to accomplish a purpose required by statute or 

executive order.

b. Systems of Records Notices. Agencies shall ensure that all SORNs remain accurate, up-todate, and appropriately scoped (see section 6(h) of this Circular for information about the 

scope of a system of records); that all SORNs are published in the Federal Register; that all 

SORNs include the information required by this Circular; and that all significant changes to 

SORNs have been reported to OMB and Congress (see section 7 of this Circular for 

information about reporting a modified system of records). 

c. Routine Uses. Agencies shall ensure that all routine uses remain appropriate and that the 

recipient’s use of the records continues to be compatible with the purpose for which the 

information was collected (see section 6(k) of this Circular for information about routine 

uses).

d. Privacy Act Exemptions. Agencies shall ensure that each exemption claimed for a system of 

records pursuant to 5 U.S.C. § 552a(j) and (k) remains appropriate and necessary (see section 

11 of this Circular for information about Privacy Act exemptions). 

 

privacy control assessments to verify the continued effectiveness of all privacy controls selected and implemented at 

an agency across the agency risk management tiers to ensure continued compliance with applicable privacy 

requirements and manage privacy risks.

109 A PCM strategy is a formal document that catalogs the available privacy controls implemented at an agency across 

the agency risk management tiers and ensures that the controls are effectively monitored on an ongoing basis by 

assigning an agency-defined assessment frequency to each control that is sufficient to ensure compliance with 

applicable privacy requirements and to manage privacy risks.
28

e. Contracts. Agencies shall ensure that the language of each contract that involves the 

creation, collection, use, processing, storage, maintenance, dissemination, disclosure, or 

disposal of information that identifies and is about individuals, is sufficient and that the 

applicable requirements in the Privacy Act and OMB policies are enforceable on the 

contractor and its employees (see section 6(j) of this Circular for information about systems 

of records operated by contractors). 

f. Privacy Training. Agencies shall ensure that the agency’s training practices are sufficient 

and that agency personnel understand the requirements of the Privacy Act, OMB guidance, 

the agency’s implementing regulations and policies, and any job-specific requirements.

13. Annual FISMA Privacy Review and Report

The Privacy Act originally required the President to submit a biennial report to Congress 

describing the administration of the statute. However, this requirement was subsequently 

repealed.110 In place of the biennial Privacy Act report, OMB now reports to Congress on 

agencies’ compliance with privacy requirements through the annual Federal Information Security 

Modernization Act of 2014 (FISMA) report to Congress.111 Each year, OMB issues guidance 

instructing each Senior Agency Official for Privacy to review the administration of the agency’s 

privacy program and report compliance data to OMB. OMB uses the reports from agencies to 

develop its annual FISMA report to Congress. 

14. Annual Matching Activity Review and Report

At the end of each calendar year, the Data Integrity Board of each agency that has participated in 

a matching program during the year shall conduct a review of that year’s matching programs and 

submit a report to the head of the agency and to OMB.112 The report for the preceding calendar 

year shall be submitted to OMB at privacy-oira@omb.eop.gov by June 1 and posted on the 

agency’s website at www.[agency].gov/privacy (see section 15 of this Circular for information 

about agency website posting requirements). 

The Data Integrity Board’s annual matching activity report shall include the following elements: 

a. Current information about the composition of the Data Integrity Board, including: 

(1) a list of the names and positions of the members of the Data Integrity Board; 

(2) the name and contact information of the Data Integrity Board’s secretary; and

(3) any changes in membership or structure of the Data Integrity Board that occurred 

during the year. 

 110 See 31 U.S.C. § 1113 note. 111 See 44 U.S.C. §§ 3551-3558. 112 See 5 U.S.C. § 552a(u)(3)(D).
29

b. A list of each matching program in which the agency participated during the year. For each 

matching program, the report shall include: 

(1) a brief description of the matching program, including the names of all participating 

Federal and non-Federal agencies; 

(2) links to the matching notice and matching agreement posted on the agency’s website 

at www.[agency].gov/privacy; 

(3) an account of whether the agency has fully adhered to the terms of the matching 

agreement;

(4) an account of whether all disclosures of agency records for use in the matching 

program continue to be justified; and 

(5) an indication of whether a cost-benefit analysis was performed, the results of the costbenefit analysis, and an explanation of why the agency proceeded with any matching 

program for which the results of the cost-benefit analysis did not demonstrate that the 

program is likely to be cost effective. 

c. For each matching program for which the Data Integrity Board waived the requirement for a 

cost-benefit analysis, the reasons for the waiver.

d. A description of any matching agreement that the Data Integrity Board disapproved and the 

reasons for the disapproval. 

e. A description of any violations of matching agreements that have been alleged or identified, 

and a discussion of any action taken in response. 

The Data Integrity Board’s annual matching activity report may also include a review of any 

agency matching activities that are not matching programs.113

15. Agency Website Posting

Agencies shall maintain a central resource page dedicated to their privacy program on their

principal website at www.[agency].gov/privacy. At a minimum, agencies shall include the 

following materials related to the Privacy Act on their central privacy program page: 

a. System of records notices. Agencies shall list and provide links to complete, up-to-date 

versions of all agency SORNs. This requires agencies to provide the following: 

(1) A list of all of the agency’s systems of records;

 113 See id. § 552a(u)(3)(H).
30

(2) Citations and links to all Federal Register notices that comprise the SORN for each 

system of records; and

(3) For any SORNs that are comprised of multiple Federal Register notices, an unofficial 

consolidated version of the SORN that describes the current system of records and 

allows members of the public to view the SORN in its entirety in a single location. 

The requirement for agencies to provide links to complete, up-to-date versions of 

SORNs on the agency’s privacy program page does not replace the Privacy Act’s 

statutory requirement for agencies to publish SORNs in the Federal Register. Notice 

in the Federal Register of the establishment or modification of a system of records 

will continue to serve as the agency’s official notice (see section 6 of this Circular for 

information about publishing SORNs). 

b. Matching notices and agreements. Agencies shall list and provide links to up-to-date 

matching notices and agreements114 for all active matching programs in which the agency 

participates (see section 8 of this Circular for information about publishing matching 

notices). 

c. Exemptions to the Privacy Act. Agencies shall provide citations and links to the final rules 

published in the Federal Register that promulgate each Privacy Act exemption claimed for 

their systems of records (see section 11 of this Circular for information about Privacy Act 

exemption rules). 

d. Privacy Act implementation rules. Agencies shall list and provide links to all Privacy Act 

implementation rules promulgated pursuant to 5 U.S.C. § 552a(f) (see section 10 of this 

Circular for information about Privacy Act implementation rules).

e. Instructions for submitting a Privacy Act request. Agencies shall provide instructions in 

clear and plain language for individuals who wish to request access to or amendment of their 

records pursuant to 5 U.S.C. § 552a(d). 

This is not an exhaustive list of the materials that agencies are required to include on their central 

privacy program page. Agencies shall refer to other OMB guidance documents to understand all 

website posting requirements. 

16. Government-wide Responsibilities

a. General. The Privacy Act places principal responsibility for compliance with its provisions 

on Federal agencies. The head of each agency shall designate a Senior Agency Official for 

Privacy who has agency-wide responsibility for privacy, including implementation of privacy 

protections; compliance with Federal laws, regulations, and policies relating to privacy; 

management of privacy risks at the agency; and a central policy-making role in the agency’s 

 114 5 U.S.C. § 552a(o)(2)(A)(ii) provides that a copy of each matching agreement “shall . . . be available upon request 

to the public.”
31

development and evaluation of legislative, regulatory, and other policy proposals. The head 

of each agency shall also ensure that the Senior Agency Official for Privacy has the 

necessary resources to carry out his or her responsibilities. At the discretion of the Senior 

Agency Official for Privacy and consistent with applicable law, other qualified agency 

personnel may perform particular functions that are assigned to the Senior Agency Official 

for Privacy in this Circular.

b. Office of Management and Budget. The Director of OMB will:

(1) Issue guidelines and directives to the agencies to implement the Privacy Act.

(2) Oversee the agencies’ implementation of the Privacy Act.

(3) Assist the agencies, at their request, in implementing their Privacy Act programs.

(4) Review agencies’ proposals pursuant to 5 U.S.C. § 552a(r). 

c. Department of Commerce. The Secretary of Commerce shall, consistent with guidelines 

issued by OMB, develop and issue standards and guidelines for ensuring the security of 

information protected by the Privacy Act in Federal information systems.

d. Federal Acquisition Regulations Council. The Federal Acquisition Regulations Council 

shall, consistent with guidelines issued by OMB, ensure that instructions are issued on what 

agencies must do in order to comply with the requirements of 5 U.S.C. § 552a(m) when 

contracting for the operation of a system of records to accomplish an agency purpose. 

e. Office of Personnel Management. The Director of the Office of Personnel Management

shall, consistent with guidelines issued by OMB: 

(1) Develop and maintain government-wide standards and procedures for civilian 

personnel information processing and recordkeeping directives to ensure compliance

with the Privacy Act.

(2) Develop and conduct Privacy Act training programs. The assignment of this 

responsibility to the Office of Personnel Management does not affect the 

responsibility of individual agency heads for developing and conducting training 

programs tailored to the specific needs of their own personnel. 

f. National Archives and Records Administration. The Archivist of the United States shall, 

consistent with guidelines issued by OMB: 

(1) Issue instructions on the format of the agency notices and rules required to be 

published under the Privacy Act.
32

(2) Compile and post on the Federal Register website a list of published agency SORNs 

that are in effect and a list of the Privacy Act implementation rules promulgated under 

5 U.S.C. § 552a(f). 

(3) Issue procedures governing the transfer of records to Federal Records Centers for 

storage, processing, and servicing, pursuant to 44 U.S.C. § 3103. For purposes of the 

Privacy Act, such records are considered to be maintained by the agency that 

deposited them. The Archivist may only disclose deposited records according to the 

access rules established by the agency that deposited them.

(4) Review and approve agencies’ proposed record retention schedules associated with 

each new system of records. 

17. Effectiveness

This Circular is effective upon issuance. However, agencies need not immediately revise or 

republish their system of records notices, matching notices/agreements, or Privacy Act 

statements or regulations to comport with the requirements of this Circular. Rather, agencies 

may make such revisions on an ongoing basis as they establish or modify any systems of records, 

matching programs, information collections, or Privacy Act regulations. 

This Circular is not intended to, and does not, create any right or benefit, substantive or 

procedural, enforceable at law or in equity by any party against the United States, its 

departments, agencies, or entities, its officers, employees, or agents, or any other person. 

18. Inquiries

All inquiries regarding this Circular should be addressed to the Office of Information and 

Regulatory Affairs, Office of Management and Budget, Washington, D.C. 20503. Telephone: 

(202) 395-3785. Email: privacy-oira@omb.eop.gov. 
33

Appendix I – Summary of Key Requirements

The following tables provide a general summary of the reporting, publication, review, and 

agency website posting requirements discussed in this Circular. The tables only include the 

specific requirements referenced in this Circular; they do not provide a complete list of the 

requirements in these areas. For more detailed explanations of these requirements, agencies shall 

consult the Privacy Act, the corresponding sections of this Circular, and additional OMB 

guidance.

Federal Register Publication Requirements

Publication Description Timing Citation(s)

System of Records 

Notices

Agencies shall publish a 

notice in the Federal 

Register describing the 

existence and character of 

a new or significantly 

modified system of 

records. Agencies shall 

also publish a notice of 

rescindment when the 

agency stops maintaining a 

system of records.

A new or revised SORN is 

effective upon publication 

in the Federal Register, 

with the exception of any 

new or modified routine 

uses, which require a 

minimum of 30 days after 

publication in the Federal 

Register before they can 

become effective. 

5 U.S.C. § 552a(e)(4); 

section 6 of this Circular.

Matching Notices Agencies shall publish a 

notice in the Federal 

Register describing an 

established, re-established, 

or significantly modified

matching program.

A new or revised matching 

notice is not effective until 

at least 30 days after its 

publication in the Federal 

Register. 

5 U.S.C. § 552a(e)(12); 

section 8 of this Circular.

Privacy Act 

Implementation Rules

Agencies shall promulgate 

rules to implement the 

provisions of the Privacy 

Act.

Agencies must publish a 

final rule before the rule is 

effective.

5 U.S.C. § 552a(f); 

section 10 of this 

Circular.

Privacy Act 

Exemption Rules

In certain circumstances, 

agencies may promulgate a 

rule to exempt a system of 

records from certain 

requirements of the 

Privacy Act.

Agencies must publish a 

final rule before the 

exemption is effective. 

5 U.S.C. § 552a(j)-(k); 

section 11 of this 

Circular.

Reporting Requirements

Report Description Timing Recipient(s) Citation(s)

Privacy Act 

Implementation 

and Exemption 

Rules

Agencies shall 

submit Privacy Act 

rules to OMB under 

applicable regulatory 

review procedures 

and as part of a 

Agencies shall 

provide proposed 

and/or final rules 

before publication 

and consult OMB

OMB (via ROCIS 

system).

5 U.S.C. § 552a(f), 

(j)-(k); Executive 

Orders 12866 and 

13563; sections 10 

and 11 of this 

Circular.
34

proposal to establish 

or significantly 

modify a system of 

records.

regarding applicable 

review procedures.

Report of New or 

Significantly 

Modified System 

of Records 

Agencies shall

report any proposal 

to establish or 

significantly modify

a system of records.

Agencies shall 

submit reports at 

least 30 days prior 

to submission of the 

notice to the Federal 

Register.

OMB (via ROCIS

system) and 

Congress (via mail).

5 U.S.C. § 552a(r); 

section 7 of this 

Circular. 

Report of New or 

Significantly 

Modified

Matching Program

Agencies shall

report any proposal 

to establish, reestablish, or 

significantly modify

a matching program.

Agencies shall 

submit reports at 

least 30 days prior 

to submission of the 

notice to the Federal 

Register.

OMB (via ROCIS 

system) and 

Congress (via mail).

5 U.S.C. § 552a(r); 

section 9 of this 

Circular. 

Annual Matching 

Activity Report

Agencies’ Data 

Integrity Boards 

shall submit a report 

describing any 

matching programs 

that occurred during 

the calendar year.

Agencies shall 

submit the annual 

report for the 

preceding calendar 

year to OMB by 

June 1.

OMB (via email to 

privacyoira@omb.eop.gov) 

and the head of the 

agency. 

5 U.S.C. § 

552a(u)(3)(D); 

section 14 of this 

Circular. 

Annual FISMA 

Privacy Report

The Senior Agency 

Official for Privacy 

shall report privacy 

compliance 

information to OMB 

as part of the annual 

FISMA reporting 

process.

Agencies shall refer 

to OMB’s annual 

FISMA guidance for 

reporting 

instructions.

OMB (see OMB’s 

annual FISMA

guidance for 

reporting

instructions).

44 U.S.C. §§ 3551-

3558; section 13 of 

this Circular. 

Agency Website Posting Requirements

Posting Description Location Citation(s)

Compilation of agencies’ 

system of records notices 

and Privacy Act 

implementation rules

The Office of the Federal 

Register shall post a 

compilation of agencies’ 

system of records notices 

and Privacy Act 

implementation rules.

The website of the Federal 

Register. 

5 U.S.C. § 552a(f).

System of Records 

Notices

Agencies shall list and 

provide links to complete, 

up-to-date versions of all 

agency SORNs. 

www.[agency].gov/privacy 5 U.S.C. § 552a(e)(4); 

section 15 of this 

Circular.

Matching Notices and 

Agreements

Agencies shall list and 

provide links to up-todate matching notices and 

agreements for all active 

matching programs.

www.[agency].gov/privacy 5 U.S.C. § 552a(o), (r); 

section 15 of this 

Circular. 

Privacy Act Exemptions Agencies shall provide 

citations and links to all 

www.[agency].gov/privacy 5 U.S.C. § 552a(j)-(k); 

section 15 of this 

Circular.
35

Privacy Act exemption 

rules.

Privacy Act 

Implementation Rules

Agencies shall list and 

provide links to all 

Privacy Act 

implementation rules.

www.[agency].gov/privacy 5 U.S.C. § 552a(f); 

section 15 of this

Circular.

Instructions for 

Submitting a Privacy Act 

Request

Agencies shall provide

instructions for 

individuals who wish to 

submit an access or 

amendment request.

www.[agency].gov/privacy 5 U.S.C. § 552a(d); 

section 15 of this 

Circular.

Agency Review Requirements

Review Description Timing Reviewer Citation(s)

Minimization –

Continuous 

Monitoring

Agencies shall ensure that no 

system of records includes 

information about an individual 

that is not relevant and 

necessary to accomplish a 

purpose required by statute or 

executive order.

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(e)(1); 

section 12 of 

this Circular.

System of 

Records Notices – 

Continuous 

Monitoring

Agencies shall ensure that all 

SORNs remain accurate, up-todate, and appropriately scoped; 

that all SORNs are published in 

the Federal Register; that all 

SORNs include the information 

required by this Circular; and 

that all significant changes to 

SORNs have been reported to 

OMB and Congress.

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(e)(4); 

section 12 of 

this Circular.

Routine Uses –

Continuous 

Monitoring

Agencies shall ensure that all 

routine uses remain appropriate 

and that the recipient’s use of 

the records continues to be 

compatible with the purpose for 

which the information was 

collected.

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(a)(7); 

section 12 of 

this Circular.

Privacy Act 

Exemptions – 

Continuous 

Monitoring

Agencies shall ensure that each 

exemption claimed for a system 

of records pursuant to 5 U.S.C. 

§ 552a(j) and (k) remains 

appropriate and necessary.

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(j)-(k); 

section 12 of 

this Circular.

Contracts –

Continuous 

Monitoring

Agencies shall ensure that the 

language of each contract that 

involves the creation, 

collection, use, processing, 

storage, maintenance, 

dissemination, disclosure, or 

disposal of information that 

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(m); 

section 12 of 

this Circular.
36

identifies and is about 

individuals, is sufficient and 

that the applicable requirements 

in the Privacy Act and OMB 

policies are enforceable on the 

contractor and its employees.

Privacy Training

– Continuous 

Monitoring

Agencies shall ensure that the 

agency’s training practices are 

sufficient and that agency 

personnel understand the 

requirements of the Privacy 

Act, OMB guidance, the 

agency’s implementing 

regulations and policies, and 

any job-specific requirements.

Agencies shall 

perform assessments 

of privacy controls 

with a frequency 

sufficient to ensure 

compliance and 

manage risks.

Senior Agency 

Official for 

Privacy

5 U.S.C. § 

552a(e)(9); 

section 12 of 

this Circular.

FISMA Review –

Annual 

The Senior Agency Official for 

Privacy shall review the 

administration of the agency’s 

privacy program as part of the 

annual FISMA reporting 

process.

Agencies shall refer 

to OMB’s annual 

FISMA guidance for 

review instructions.

Senior Agency 

Official for 

Privacy

44 U.S.C. §§ 

3551-3558; 

section 13 of 

this Circular.

Review of 

Matching 

Programs – 

Annual 

Agencies’ Data Integrity 

Boards shall review all 

matching programs in which 

the agency has participated 

during the calendar year.

Agencies’ Data 

Integrity Boards 

shall conduct the 

review at the end of 

the calendar year 

and report to OMB 

by June 1.

Agency’s Data 

Integrity Board

5 U.S.C. § 

552a(u)(3)(B)-

(C); section 14

of this 

Circular.

Review of Other 

Matching 

Activities – 

Annual 

Agencies’ Data Integrity 

Boards may also review any 

agency matching activities that 

are not matching programs.

Agencies’ Data 

Integrity Boards 

shall conduct any 

review at the end of 

the calendar year 

and report to OMB 

by June 1.

Agency’s Data 

Integrity Board

5 U.S.C. § 

552a(u)(3)(H); 

section 14 of 

this Circular.
37

Appendix II 

Office of the Federal Register SORN Template – Full Notice

Agencies shall publish all system of records notices (SORNs) in the Federal Register using the 

appropriate format provided in the appendices to this Circular. Agencies shall use the language 

and section headings provided in the template and replace the language in brackets with the 

appropriate agency language.

Appendix II provides the Office of the Federal Register SORN template for full notices that 

include all of the elements that are required to be in a SORN. Agencies shall use this template 

when publishing a new SORN or choosing to publish a revised SORN in its entirety. 

[Name of agency] 

Privacy Act of 1974; System of Records 

AGENCY: [Name of agency and, if applicable, agency component]. 

ACTION: Notice of a [New/Modified] System of Records. 

SUMMARY: [A plain-language description of the system]. 

DATES: [The deadline to submit comments on the proposal and the date on which any routine 

uses will be effective]. 

ADDRESSES: [Instructions for submitting comments on the proposal, including an email 

address or a website where comments can be submitted electronically]. 

FOR FURTHER INFORMATION CONTACT: [Instructions for submitting general 

questions about the system]. 

SUPPLEMENTARY INFORMATION: [Background information about the proposal, 

including a description of any changes being made to the system and the purpose(s) of the 

changes]. 

SYSTEM NAME AND NUMBER: [A name for the system that is unambiguous and clearly 

identifies the purpose or character of the system, and the number of the system]. 

SECURITY CLASSIFICATION: [An indication of whether any information in the system is 

classified]. 

SYSTEM LOCATION: [The address of the agency and/or component responsible for the 

system, as well as the address of any third-party service provider]. 
38

SYSTEM MANAGER(S): [The title, business address, and contact information of the agency 

official who is responsible for the system]. 

AUTHORITY FOR MAINTENANCE OF THE SYSTEM: [The specific authority that 

authorizes the maintenance of the records in the system]. 

PURPOSE(S) OF THE SYSTEM: [A description of the agency’s purpose(s) for maintaining 

the system]. 

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: [The categories of 

individuals on whom records are maintained in the system]. 

CATEGORIES OF RECORDS IN THE SYSTEM: [The categories of records maintained in 

the system and, if practicable and useful for public notice, specific data elements]. 

RECORD SOURCE CATEGORIES: [The categories of sources of records in the system]. 

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING 

CATEGORIES OF USERS AND PURPOSES OF SUCH USES: [Each routine use of the 

records contained in the system, including the categories of users and the purpose of such use]. 

POLICIES AND PRACTICES FOR STORAGE OF RECORDS: [The policies and 

practices of the agency regarding the storage of records]. 

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: [The policies and 

practices of the agency regarding retrieval of records]. 

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: 

[The policies and practices of the agency regarding retention and disposal of records]. 

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: [A description of 

the administrative, technical, and physical safeguards to which the system is subject]. 

RECORD ACCESS PROCEDURES: [The agency procedures whereby an individual can be 

notified at his or her request how he or she can gain access to any record pertaining to him or her 

in the system]. 

CONTESTING RECORD PROCEDURES: [The agency procedures whereby an individual 

can be notified at his or her request how he or she can contest the content of any record 

pertaining to him or her in the system]. 

NOTIFICATION PROCEDURES: [The agency procedures whereby an individual can be 

notified at his or her request if the system contains a record pertaining to him or her]. 

EXEMPTIONS PROMULGATED FOR THE SYSTEM: [Any Privacy Act exemptions 

promulgated for the system]. 
39

HISTORY: [Citation(s) to the last full Federal Register notice that includes all of the elements 

that are required to be in a SORN, as well as any subsequent notices of revision]. 
40

Appendix III 

Office of the Federal Register SORN Template – Notice of Revision

Agencies shall publish all system of records notices (SORNs) in the Federal Register using the 

format provided in the appendices to this Circular. Agencies shall use the language and section 

headings provided in the template and replace the language in brackets with the appropriate 

agency language.

Appendix III provides the Office of the Federal Register SORN template for revised notices that 

describe a modified system of records when the agency chooses not to publish the revised SORN 

in its entirety. The elements provided in the template are required to appear in any notice of a 

modified system of records. Elements omitted from the template shall be included in a notice of 

a modified system of records if there are revisions to those elements.

[Name of agency] 

Privacy Act of 1974; System of Records 

AGENCY: [Name of agency and, if applicable, agency component]. 

ACTION: Notice of a Modified System of Records. 

SUMMARY: [A plain-language description of the system]. 

DATES: [The deadline to submit comments on the proposal and the date on which any routine 

uses will be effective]. 

ADDRESSES: [Instructions for submitting comments on the proposal, including an email 

address or a website where comments can be submitted electronically]. 

FOR FURTHER INFORMATION CONTACT: [Instructions for submitting general 

questions about the system]. 

SUPPLEMENTARY INFORMATION: [Background information about the proposal, 

including a description of the changes being made to the system and the purpose(s) of the 

changes]. 

SYSTEM NAME AND NUMBER: [A name for the system that is unambiguous and clearly 

identifies the purpose or character of the system, and the number of the system]. 

SECURITY CLASSIFICATION: [An indication of whether any information in the system is 

classified]. 
41

SYSTEM LOCATION: [The address of the agency and/or component responsible for the 

system, as well as the address of any third-party service provider]. 

SYSTEM MANAGER(S): [The title, business address, and contact information of the agency 

official who is responsible for the system]. 

... 

[Agencies shall review the other elements in the full SORN template in Appendix II to this 

Circular and include elements for which revisions are necessary. For example, if an agency is 

modifying the categories of records in the system, the agency shall include that element in the 

notice of revision.] 

... 

HISTORY: [Citation(s) to the last full Federal Register notice that includes all of the elements 

that are required to be in a SORN, as well as any subsequent notices of revision]. 
42

Appendix IV

Office of the Federal Register Notice of Rescindment Template

Agencies are required to publish a notice of rescindment in the Federal Register whenever they 

stop maintaining a previously established system of records. Agencies shall publish all notices 

of rescindment using the format provided in Appendix IV to this Circular. Agencies shall use 

the language and section headings provided in the template and replace the language in brackets 

with the appropriate agency language.

[Name of agency] 

Privacy Act of 1974; System of Records 

AGENCY: [Name of agency and, if applicable, agency component]. 

ACTION: Rescindment of a System of Records Notice. 

SUMMARY: [A plain-language description of the system that is being discontinued]. 

DATES: [The date on which the agency stopped or will stop maintaining the system of 

records]. 

ADDRESSES: [Instructions for submitting comments on the notice, including an email address 

or a website where comments can be submitted electronically]. 

FOR FURTHER INFORMATION CONTACT: [Instructions for submitting general 

questions about the discontinued system]. 

SUPPLEMENTARY INFORMATION: [Background information about the proposal, 

including an account of what will happen to the records that were previously maintained in the 

system and references to any other SORN that will pertain to the records]. 

SYSTEM NAME AND NUMBER: [The name and number of the system that is being 

discontinued]. 

HISTORY: [Citation(s) to the last full Federal Register notice that includes all of the elements 

that are required to be in a SORN, as well as any subsequent notices of revision]. 
43

Appendix V

Office of the Federal Register Matching Notice Template – Full Notice

Agencies shall publish all matching notices in the Federal Register using the format provided in 

the appendices to this Circular. Agencies shall use the language and section headings provided 

in the template and replace the language in brackets with the appropriate agency language. 

Appendix V provides the Office of the Federal Register matching notice template for full notices 

that include all of the elements that are required to be in a matching notice. Agencies shall use 

this template when publishing a notice of the establishment or re-establishment of a matching 

program, or when publishing a revised matching notice in its entirety. 

[Name of agency] 

Privacy Act of 1974; Matching Program 

AGENCY: [Name of agency and, if applicable, agency component]. 

ACTION: Notice of a [New/Modified] Matching Program. 

SUMMARY: [A plain-language description of the matching program]. 

DATES: [The deadline to submit comments on the proposal, as well as the beginning and 

ending dates of the matching program]. 

ADDRESSES: [Instructions for submitting comments on the matching program, including an 

email address or a website where comments can be submitted electronically]. 

FOR FURTHER INFORMATION CONTACT: [Instructions for submitting general 

questions about the matching program]. 

SUPPLEMENTARY INFORMATION: [Background information about the proposal]. 

PARTICIPATING AGENCIES: [The name of the participating agency or agencies, including 

any non-Federal agencies]. 

AUTHORITY FOR CONDUCTING THE MATCHING PROGRAM: [The specific 

authority for conducting the matching program]. 

PURPOSE(S): [A plain-language description of the agency’s purpose(s) for conducting the 

matching program]. 

CATEGORIES OF INDIVIDUALS: [The categories of individuals whose information is 

involved in the matching program]. 
44

CATEGORIES OF RECORDS: [The categories of records involved in the matching program 

and the specific data elements that are matched]. 

SYSTEM(S) OF RECORDS: [The names of all relevant systems of records and a citation of 

the system of records notices]. 
45

Appendix VI

Office of the Federal Register Matching Notice Template – Notice of Revision 

Agencies shall publish all matching notices in the Federal Register using the format provided in 

the appendices to this Circular. Agencies shall use the language and section headings provided 

in the template and replace the language in brackets with the appropriate agency language. 

Appendix VI provides the Office of the Federal Register matching notice template for revised 

notices that describe a modified matching program when the agency chooses not to publish the 

revised notice in its entirety. The elements provided in the template are required to appear in any 

notice of a modified matching program. Elements omitted from the template shall be included in 

a notice of a modified matching program if there are revisions to those elements.

[Name of agency] 

Privacy Act of 1974; Matching Program 

AGENCY: [Name of agency and, if applicable, agency component]. 

ACTION: Notice of a Modified Matching Program. 

SUMMARY: [A plain-language description of the matching program]. 

DATES: [The deadline to submit comments on the proposal, as well as the beginning and 

ending dates of the matching program]. 

ADDRESSES: [Instructions for submitting comments on the proposal, including an email 

address or a website where comments can be submitted electronically]. 

FOR FURTHER INFORMATION CONTACT: [Instructions for submitting general 

questions about the matching program]. 

SUPPLEMENTARY INFORMATION: [Background information about the proposal]. 

PARTICIPATING AGENCIES: [The name of the participating agency or agencies, including 

any non-Federal agencies]. 

... 

[Agencies shall review the other elements in the full matching notice template in Appendix V to 

this Circular and include elements for which revisions are necessary. For example, if an agency 

is modifying the categories of records involved in the matching program, the agency shall 

include that element in the notice of revision.]